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Foreword 



This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). 

The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or 
GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. 

The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under 
http://webapp.etsi.org/kev/quervform.asp . 

The 3GPP Confidentiality and Integrity Algorithms f 8 & f9 have been developed through the collaborative efforts of the 
European Telecommunications Standards Institute (ETSI), the Association of Radio Industries and Businesses (ARIB), 
the Telecommunications Technology Association (TTA), the Tl Committee. 

The f8 & f 9 Algorithms Specifications may be used only for the development and operation of 3G Mobile 
Communications and services. Every Beneficiary must sign a Restricted Usage Undertaking with the Custodian and 
demonstrate that he fulfills the approval criteria specified in the Restricted Usage Undertaking. 

Furthermore, Mitsubishi Electric Corporation holds essential patents on the Algorithms. The Beneficiary must get a 
separate IPR License Agreement from Mitsubishi Electronic Corporation Japan. 

For details of licensing procedures, contact ETSI, ARIB, TTA or Tl. 



The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

X the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 



Introduction 



This specification has been prepared by the 3GPP Task Force, and gives a detailed specification of the 3GPP Algorithm 
KASUMI. KASUMI is a block cipher that forms the heart of the 3GPP confidentiality algorithm/5, and the 3GPP 
integrity algorithm /P. 

This document is the second of four, which between them form the entire specification of the 3GPP Confidentiality and 
Integrity Algorithms: 

3GPP TS 35.201: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity Algorithms; Document 1: /8 and 
f9 Specification". 

- 3GPP TS 35.202: "3rd Generation Partnership Project; Technical Specification Group Services and 
System Aspects; 3G Security; Specification of the 3GPP ConfidentiaUty and Integrity Algorithms; 
Document 2: KASUMI Specification". 
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3GPP TS 35.203: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity Algorithms; Document 3: 
Implementors" Test Data". 

3GPP TS 35.204: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity Algorithms; Document 4: Design 
Conformance Test Data". 

The normative part of the specification of KASUMI is in the main body of this document. The annexes to this 
document are purely informative. Annex 1 contains illustrations of functional elements of the algorithm, while Annex 2 
contains an implementation program listing of the cryptographic algorithm specified in the main body of this document, 
written in the programming language C. 

Similarly the normative part of the specification of the /S (confidentiality) and the/? (integrity) algorithms is in the 
main body of Document 1 . The annexes of those documents, and Documents 3 and 4 above, are purely informative. 
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Scope 



This specification gives a detailed specification of the 3GPP Algorithm KASUMI. KASUMI is a block cipher that 
forms the heart of the 3GPP confidentiality algorithm _/S, and the 3GPP integrity algorithm/?. 
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NORMATIVE SECTION 

This part of the document contains the normative specification of the KASUMI algorithm. 
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1 Outline of the normative part 

Section 2 introduces the algorithm and describes the notation used in the subsequent sections. 
Section 3 defines the algorithm structure and its operation. 
Section 4 defines the basic components of the algorithm. 

1.1 References 

The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including 
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same 
Release as the present document. 

[1] 3GPP TS 33.102 version 3.2.0: "3rd Generation Partnership Project; Technical Specification 

Group Services and System Aspects; 3G Security; Security Architecture". 

[2] 3GPP TS 33.105 version 3.1.0: "3rd Generation Partnership Project; Technical Specification 

Group Services and System Aspects; 3G Security; Cryptographic Algorithm Requirements". 

[3] 3GPP TS 35.201: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity 
Algorithms; Document 1: f8 and f9 Specification". 

[4] 3GPP TS 35.202: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity 
Algorithms; Document 2: KASUMI Specification". 

[5] 3GPP TS 35.203: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity 
Algorithms; Document 3: Implementors" Test Data". 

[6] 3GPP TS 35.204: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity 
Algorithms; Document 4: Design Conformance Test Data". 

[7] ISO/IEC 9797-1 : 1999: "Information technology - Security techniques - Message Authentication 

Codes (MACs)". 



Introductory information 



2.1 Introduction 

Within the security architecture of the 3GPP system there are two standardised algorithms: A confidentiality algorithm 
f8, and an integrity algorithm /9. These algorithms are fully specified in a companion document[3]. Each of these 
algorithms is based on the KASUMI algorithm that is specified here. 

KASUMI is a block cipher that produces a 64-bit output from a 64-bit input under the control of a 128-bit key. 
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2.2 Notation 

2.2.1 Radix 

We use the prefix Ox to indicate hexadecimal numbers. 

2.2.2 Bit/Byte ordering 

All data variables in this specification are presented with the most significant bit (or byte) on the left hand side and the 
least significant bit (or byte) on the right hand side. Where a variable is broken down into a number of sub-strings, the 
left most (most significant) sub-string consists of the most significant part of the original string and so on through to the 
least significant. 

For example if a 64-bit value X is subdivided into four 16-bit substrings P, Q, R, S we have: 

X = 0x01 23456789 ABCDEF 

we have: 

P = 0x0123, Q = 0x4567, R = Ox89AB, S = OxCDEF. 

In binary this would be: 

X = 000000010010001 10100010101 1001 1 1 10001001 1010101 1 1 1001 101 1 1 101 1 1 1 

with P = 0000000 1 00 1 000 1 1 

2 = 0100010101100111 

R= 1000100110101011 
S= 1100110111101111 

2.2.3 Conventions 

We use the assignment operator "=", as used in several programming languages. When we write 

<variable> = <expression> 
we mean that <variable> assumes the value that <expression> had before the assignment took place. For instance, 

x = X + y + 3 
means 

(new value of x) becomes (old value of x) + (old value of y) h- 3. 

2.2.4 Subfunctions 

KASUMI decomposes into a number of subfunctions {FL, FO, FT) which are used in conjunction with associated sub- 
keys {KL, KO, KT) in a Feistel structure comprising a number of rounds (and rounds within rounds for some 
subfunctions). Specific instances of the function and/or keys are represented by XXjj where i is the outer round number 
of KASUMI and J is the inner round number. 

For example the function FO comprises three rounds of the function FI, so we designate the third round of FI in the 
fifth round of KASUMI as FIs3- 
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2.2.5 List of Symbols 



= The assignment operator. 

© The bitwise exclusive-OR operation. 

II The concatenation of the two operands. 

«<n The left circular rotation of the operand by n bits. 

ROL( ) The left circular rotation of the operand by one bit. 

n The bitwise AND operation. 

u The bitwise OR operation. 



2.3 List of Functions and Variables 

/( ) The round function for the i* round of KASUMI 

FI() A subfunction within KASUMI that translates a 16-bit input to a 16-bit output using a 16-bit 

subkey. 

FL() A subfunction within KASUMI that translates a 32-bit input to a 32-bit output using a 32-bit 

subkey. 

FO() A subfunction within KASUMI that translates a 32-bit input to a 32-bit output using two 48-bit 

subkey s. 

K A 128-bit key. 

KL„KOi,KIi subkeys used within the i* round of KASUMI. 



S7[] 
S9[] 



An S-Box translating a 7-bit input to a 7-bit output. 
An S-Box translating a 9-bit input to a 9-bit output. 



KASUMI operation 



3.1 



Introduction 



(See figure 1 in Annex 1) 

KASUMI is a Feistel cipher with eight rounds. It operates on a 64-bit data block and uses a 128-bit key. In this section 
we define the basic eight-round operation. In section 4 we define in detail the make-up of the round function _/}( ). 
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3.2 Encryption 

KASUMI operates on a 64-bit input / using a 128-bit key K to produce a 64-bit output OUTPUT, as follows: 

The input / is divided into two 32-bit strings Lo and Ro, where 

I = Lo II Ro 

Then for each integer i with 1 < / < 8 we define: 

Ri = Li.i, Li = Ri.i©fi(Li.i,RKi) 

This constitutes the i* round function of KASUMI, where /J- denotes the round function with Lt.j and round key 
RKi as inputs (see section 4 below). 

The result OUTPUT is equal to the 64-bit string (Lg II Rg) offered at the end of the eighth round. See figure 1 of 
Annex 1. 

In the specifications for the/5 and/9 functions we represent this transformation by the term: 

OUTPUT = KASUMI[ / ]k 



Components of KASUMI 



4.1 Function f, 

(See figure 1 in Annex 1) 

The function/( ) takes a 32-bit input / and returns a 32-bit output O under the control of a round key RKi, where the 
round key comprises the subkey triplet of (KLi, KOi, Kit). The function itself is constructed from two subfunctions; FL 
and FO with associated subkeys KLi (used with FL) and subkeys KOi and KIi (used with FO). 

The/( ) function has two different forms depending on whether it is an even round or an odd round. 

For rounds 1,3,5 and 7 we define: 

fi(I, RKi) = FO( FL( I, KLi), KOj, KIj ) 
and for rounds 2,4,6 and 8 we define: 

fi(I, RKi) = FL( FO( I, KOi, Kli ), KLi ) 

i.e. For odd rounds the round data is passed through FL{ ) and then FO{ ), whilst for even rounds it is passed through 
FO( ) and then fL(). 

4.2 Function FL 

(See figure 4 in Annex 1) 

The input to the function FL comprises a 32-bit data input / and a 32-bit subkey KLi. The subkey is split into two 16- 
bit subkeys, KLij and KLi2 where 

KLi = KLi,illKLi,2. 

The input data / is split into two 16-bit halves, L and R where I = L W R. 

We define: 

R' = R®ROL{Lr\ KLi^) 
L' = L®ROL{R'^ KLi2) 

The 32-bit output value k{L'\\R'). 
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4.3 Function FO 

(See figure 2 in Annex 1) 

The input to the function FO comprises a 32-bit data input / and two sets of subkeys, a 48-bit subkey KOj and 48-bit 
subkey KIi. 

The 32-bit data input is split into two halves, Lq and Rq where I = LgW Rq. 

The 48-bit subkeys are subdivided into three 16-bit subkeys where 

KOi = KOii II KOi,2 II KOi,3 and KI; = KIji II KIi,2 II Klja. 

Then for each integerj with 1 <j < 3 we define: 

Rj = FI(Lj., ® KOij , KIij ) © Rj.j 

Finally we return the 32-bit value (L3 II R3). 

4.4 Function Fl 

(See figure 3 in Annex 1 . The thick and thin lines in this diagram are used to emphasise the difference between the 
9-bit and 7-bit data paths respectively). 

The function FI takes a 16-bit data input / and 16-bit subkey KIij. The input / is split into two unequal components, a 
9-bit left half Lo and a 7-bit right half /?o where I = Lo\\Ro- 

Similarly the key KIij is split into a 7-bit component KIij] and a 9-bit component KIij2 where KIij = KIjjj II KIij2- 

The function uses two S-boxes, S7 which maps a 7-bit input to a 7-bit output, and S9 which maps a 9-bit input to a 9-bit 
output. These are fully defined in section 4.5. It also uses two additional functions which we designate ZE{ ) and TR{ ). 
We define these as: 

ZE{ X ) takes the 7-bit value x and converts it to a 9-bit value by adding two zero bits to the most-significant end. 

TR{ X ) takes the 9-bit value x and converts it to a 7-bit value by discarding the two most-significant bits. 

We define the following series of operations: 

Li = Ro R, = S9\Lo\®ZE{Ro) 

L2 = Ri® KIij2 R2 = S7[Lj] © TRiR,) © Klijj 

L3 = R2 R3 = S9[L2]®ZEiR2) 

L, = S7[L3]®TR{R3) R, = R3 
The function returns the 16-bit value {L4 II R4). 
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4.5 



S-boxes 



The two S-boxes have been designed so that they may be easily implemented in combinational logic as well as by a 
look-up table. Both forms are given for each table. 

The input AC comprises either seven or nine bits with a corresponding number of bits in the output _y. We therefore have: 

X =x8 \\x7 \\x6\\x5 \\x4\\x3 \\x2 Wxl WxO 
and 

y =y8 \\y7 \\y6 \\y5 \\y4 \\y3 \\y2 Wyl WyO 

where the x8, y8 and x7,y7 bits only apply to S9, and the xO and yO bits are the least significant bits. 

In the logic equations: 

x0xlx2 implies xO n xl n x2 where n is the AND operator. 
© is the exclusive-OR operator. 

Following the presentation of the logic equations and the equivalent look-up table an example is given of the use of 
each. 

4.5.1 S7 

Gate Logic : 

yO =xlx3©x4@x0xlx4©x5@x2x5@x3x4x5©x6@x0x6©xlx6@x3x6@x2x4x6©xlx5x6 

@x4x5x6 
yl =x0xl©x0x4@x2x4©x5@xlx2x5@x0x3x5©xS@x0x2x6©x3x6©x4x5x6®l 
y2 =x0©x0x3@x2x3©xlx2x4@x0x3x4@xlx5©x0x2x5®x0x6©x0xlx6©x2x6@x4x6©l 
y3 =xl©x0xlx2@xlx4©x3x4@x0x5®x0xlx5©x2x3x5@xlx4x5@x2x6©xlx3x6 
y4 =x0x2©x3@xlx3©xlx4@x0xlx4@x2x3x4©x0x5@xlx3x5©x0x4x5©xlx6®x3x6 

®x0x3x6©x5x6®l 
y5 =x2©x0x2®x0x3©xlx2x3®x0x2x4®x0x5©x2x5®x4x5©xlx6©xlx2x6®x0x3x6 

®x3x4xe©x2x5x6®l 
y6 =xlx2©x0xlx3®x0x4©xlx5©x3x5®x6©x0xlx6®x2x3x6©xlx4x6©x0x5x6 

Decimal Table : 



54 


50 


62, 


56, 


22 


34, 


94 


96 


38, 


6 


63 


93, 


2 


18 


123, 


33 


55 


113 


39, 


114, 


21 


67, 


65 


12 


47, 


73 


46 


27, 


25 


111 


124, 


81 


53 


9 


121, 


79, 


52 


60, 


58 


48 


101, 


127 


40 


120, 


104 


70 


71, 


43 


20 


122 


72, 


61, 


23 


109, 


13 


100 


77, 


1 


16 


7, 


82 


10 


105, 


98 


117 


116 


76, 


11, 


89 


106, 





125 


118, 


99 


86 


69, 


30 


57 


126, 


87 


112 


51 


17, 


5, 


95 


14, 


90 


84 


91, 


8 


35 


103, 


32 


97 


28, 


66 


102 


31 


26, 


45, 


75 


4, 


85 


92 


37, 


74 


80 


49, 


68 


29 


115, 


44 


64 


107 


108, 


24, 


110 


83, 


36 


78 


42, 


19 


15 


41, 


88 


119 


59, 


3 



Example: 

If we have an input value = 38, then using the decimal table S7[38] = 58. 
For the combinational logic we have: 



38 = 01001102 



x6 = 0, x5=l, x4=0, x3=0, x2=l, xl=l, xO=0 
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which gives us: 



yo = oeoeoe i e i eoeoeoeoeoeoeoeo 
y 1 = oeoeoe i e i eoeoeoeoeoe i = i 

y2 = oeoeoeoeoe i eoeoeoeoeoe i = o 
y3 = leoeoeoeoeoeoeoeoeo = i 

y4 = oeoeoeoeoeoeoeoeoeoeoeoeoei = i 
y5 = 1 eoeoeoeoeoe ieoeoeoeoeoeoei= i 
y6 = 1 eoeoe i eoeoeoeoeoeo = o 



Thus y = 01 110102 = 58 



4.5.2 S9 



Gate Logic : 



yO = X0x2®x3©x2x5@x5x6©x0x7©xlx7®x2x7©x4x8@x5x8©x7x8©l 

yl = Xl@x0xl©x2x3@x0x4©xlx4©x0x5®x3x5©x6@xlx7©x2x7©x5x8®l 

y2 = xl®x0x3©x3x4®x0x5©x2x6©x3x6®x5x6©x4x7®x5x7©xGx7©x8®x0x8©l 

y3 = X0®xlx2©x0x3®x2x4©x5©x0x6®xlx6©x4x7®x0x8©xlx8©x7x8 

y4 = X0xl®xlx3©x4®x0x5©x3x6©x0x7®x6x7©xlx8®x2x8©x3x8 

y5 = X2®xlx4©x4x5®x0x6©xlx6©x3x7ffix4x7©x6x7®x5x8©x6x8©x7x8®l 

y6 = X0®x2x3©xlx5®x2x5©x4x5©x3x6®x4x6©x5x6®x7©xlx8©x3x8®x5x8©x7x8 

y7 = X0xl®x0x2©xlx2®x3©x0x3©x2x3®x4x5©x2x6®x3x6©x2x7©x5x7®x8©l 

y8 = X0xl®x2©xlx2®x3x4©xlx5©x2x5®xlx6©x4x6®x7©x2x8©x3x8 



Decimal Table : 



167 
183 
175 

95 
165 
501 
232 
344 
487 
475 
363 
439 
465 
173 
280 
132 

35 

50 

72 

185 

1 

336 

47 
414 
266 
311 
485 
312 
284 

97 
438 

43 



,239,161 


379 


391 


334 


9 


338 


38 


226 


48 


358 


452,385, 90,397, 


,253,147 


331 


415 


340 


51 


362 


306 


500 


262 


82 


216,159,356,177, 


,241,489 


37 


206 


17 





333 


44 


254 


378 


58 


143,220, 81,400, 


3,315 


245 


54 


235 


218 


405 


472 


264 


172 


494 


371,290,399, 76, 


,197,395 


121 


257 


480 


423 


212 


240 


28 


462 


176 


406,507,288,223, 


,407,249 


265 


89 


186 


221 


428 


164 


74 


440 


196 


458,421,350,163, 


,158,134 


354 


13 


250 


491 


142 


191 


69 


193 


425 


152,227,366,135, 


,300,276 


242 


437 


320 


113 


278 


11 


243 


87 


317 


36, 93,496, 27, 


,446,482 


41 


68 


156 


457 


131 


326 


403 


339 


20 


39,115,442,124, 


,384,508 


53 


112 


170 


479 


151 


126 


169 


73 


268 


279,321,168,364, 


,292, 46 


499 


393 


327 


324 


24 


456 


267 


157 


460 


488,426,309,229, 


,506,208 


271 


349 


401 


434 


236 


16 


209 


359 


52 


56,120,199,277, 


,416,252 


287 


246 


6 


83 


305 


420 


345 


153 


502 


65, 61,244,282, 


,222,418 


67 


386 


368 


261 


101 


476 


291 


195 


430 


49, 79,166,330, 


,383,373 


128 


382 


408 


155 


495 


367 


388 


274 


107 


459,417, 62,454, 


,225,203 


316 


234 


14 


301 


91 


503 


286 


424 


211 


347,307,140,374, 


,103,125 


427 


19 


214 


453 


146 


498 


314 


444 


230 


256,329,198,285, 


,116, 78 


410 


10 


205 


510 


171 


231 


45 


139 


467 


29, 86,505, 32, 


, 26,342 


150 


313 


490 


431 


238 


411 


325 


149 


473 


40,119,174,355, 


,233,389 


71 


448 


273 


372 


55 


110 


178 


322 


12 


469,392,369,190, 


,109,375 


137 


181 


88 


75 


308 


260 


484 


98 


272 


370,275,412,111, 


,318, 4 


504 


492 


259 


304 


77 


337 


435 


21 


357 


303,332,483, 18, 


, 85, 25 


497 


474 


289 


100 


269 


296 


478 


270 


106 


31,104,433, 84, 


,486,394 


96 


99 


154 


511 


148 


413 


361 


409 


255 


162,215,302,201, 


,351,343 


144 


441 


365 


108 


298 


251 


34 


182 


509 


138,210,335,133, 


,352,328 


141 


396 


346 


123 


319 


450 


281 


429 


228 


443,481, 92,404, 


,422,248 


297 


23 


213 


130 


466 


22 


217 


283 


70 


294,360,419,127, 


,377, 7 


468 


194 


2 


117 


295 


463 


258 


224 


447 


247,187, 80,398, 


,353,105 


390 


299 


471 


470 


184 


57 


200 


348 


63 


204,188, 33,451, 


, 30,310 


219 


94 


160 


129 


493 


64 


179 


263 


102 


189,207,114,402, 


,477,387 


122 


192 


42 


381 


5 


145 


118 


180 


449 


293,323,136,380, 


, 66, 60 


455 


341 


445 


202 


432 


8 


237 


15 


376 


436,464, 59,461 
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Example: 

If we have an input value = 138, then using the decimal table S9[138] = 339. 
For the combinational logic we have: 

138 = 0100010102 ^ x8 = 0, x7= l,x6 = 0, x5=0, x4=0, x3=l,x2=0, xl=l,xO=0 
which gives us: 

yo = oe 1 eoeoeoe i eoeoeoeoe i = i 

yi = leoeoeoeoeoeoeoeieoeoei = i 

y2 = ieoeoeoeoeoeoeoeoeoeoeoei =o 

y3 = oeoeoeoeoeoeoeoeoeoeo = o 

y4 = oe 1 eoeoeoeoeoeoeoeo = i 

y5 = oeoeoeoeoe i eoeoeoeoeoe i = o 

y6 = oeoeoeoeoeoeoeoe i eoeoeoeo = i 

y7 = oeoeoeieoeoeoeoeoeoeoeoei =o 

y8 = oeoeoeoeoeoeoeoe i eoeo = i 

Thus y= 1010100112 = 339 



4.6 Key Schedule 



KASUMI has a 128-bit key K. Each round of KASUMI uses 128 bits of key that are derived from K. Before the round 
keys can be calculated two 16-bit arrays Kj and Kj' (j=\ to 8) are derived in the following manner: 

The 128-bit key K is subdivided into eight 16-bit values K1...K8 where 

K = K1IIK2IIK3II...IIK8. 

A second array of subkeys, Kj' is derived from Kj by applying: 

For each integer j with 1 < j < 8 

Kj'= KjeCj 

Where Cj is the constant value defined in table 2. 

The round subkeys are then derived from Kj and Kj' in the manner defined in table 1 . 

Table 1 : Round subkeys 



KLi,i 
KLi,2 

KOi,i 
K0i,2 
K0i,3 



Kli 
Kli 
Kli 



1 


2 


3 


4 


5 


6 


7 


8 


K1«<1 


K2«<1 


K3«<1 


K4«<1 


K5«<1 


K6«<1 


K7«<1 


K8«<1 


K3' 


K4' 


K5' 


K6' 


K7' 


K8' 


K1' 


K2' 


K2«<5 


K3«<5 


K4«<5 


K5«<5 


K6«<5 


K7«<5 


K8«<5 


K1«<5 


K6«<8 


K7«<8 


K8«<8 


K1«<8 


K2«<8 


K3«<8 


K4«<8 


K5«<8 


K7«<13 


K8«<13 


K1«<13 


K2«<13 


K3«<13 


K4«<13 


K5«<13 


K6«<13 


K5' 


K6' 


K7' 


K8' 


K1' 


K2' 


K3' 


K4' 


K4' 


K5' 


K6' 


K7' 


K8' 


K1' 


K2' 


K3' 


K8' 


K1' 


K2' 


K3' 


K4' 


K5' 


K6' 


K7' 
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Table 2: Constants 



C1 


0x0123 


C2 


0x4567 


C3 


0x89AB 


C4 


OxCDEF 


C5 


OxFEDC 


C6 


0xBA98 


C7 


0x7654 


C8 


0x3210 
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INFORMATIVE SECTION 

This part of the document is purely informative and does not form part of the normative specification of KASUMI. 
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Annex 1 (informative): 

Figures of the KASUIVII Algorithm 






KI; 



i,J,2 



Fig.2: FO Function Fig. 3: FI Function 

32 




I I bitwise AND operation 
I I bitwise OR operation 
<^<^<^ one bit left rotation 



Fig. liKASUMI 



Fig.4: FL Function 
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KASUMI has a number of characteristics that may be exploited in a hardware implementation and these are highlighted 
here. 

The simple key schedule is easy to implement in hardware. 

The S-Boxes have been designed so that they may be implemented by a small amount of combinational logic 
rather than by large look-up tables. 

The S7-Box and S9-Box operations in the FI function may be carried out in parallel (see alternative presentation 
in figure 5). 

The Fli 1 and Fli 2 operations may be carried out in parallel (see alternative presentation in figure 6). 




C>^"— K) 





Fig. 5: FI Function 



Fig. 6: FO Function 



£75/ 



3GPP TS 35.202 version 1 1 .0.0 Release 1 1 20 ETSI TS 1 35 202 V1 1 .0.0 (201 2-1 1 ) 



Annex 2 (informative): 
Simulation Program Listing 



Header file 

/* 



Kasumi .h 



typedef unsigned char u8 
typedef unsigned short ul6 
typedef unsigned long u32 

void KeySchedule { u8 *key ) 
void Kasumi { u8 *data ) ; 

CCode 



Kasumi . c 



A sample implementation of KASUMI, the core algorithm for the 
3GPP Confidentiality and Integrity algorithms. 

This has been coded for clarity, not necessarily for efficiency. 

This will compile and run correctly on both Intel {little endian) 

and Sparc {big endian) machines. {Compilers used supported 32-bit ints) 

Version 1.1 08 May 2000 



#include " Kasumi. h" 

/* ig bit rotate left 

#define R0L16 {a,b) {ul6) { {a<<b) | {a>> {16-b) ) ) 

/* unions: used to remove "endian" issues 



typedef union { 

u32 b32; 

ul6 bl6 [2] ; 

u8 b8 [4] ; 
} DWORD ; 

typedef union { 

ul6 bl6; 

u8 b8 [2] ; 
} WORD; 

/* globals: The subkey arrays 

static ul6 KLil[8], KLi2 [8] ; 

static ul6 K0il[8], K0i2 [8] , K0i3 [8] ; 

static ul6 KIil[8], KIi2 [8] , KIi3 [8] ; 



/* 

* FI{) 

* The FI function {fig 3) . It includes the S7 and S9 tables. 

* Transforms a 16 -bit value. 

* 1 

static ul6 FI { ul6 in, ul6 subkey ) 

{ 

ul6 nine, seven; 
static ul6 S7 [] = { 

54, 50, 62, 56, 22, 34, 94, 96, 38, 6, 63, 93, 2, 18,123, 33, 
55,113, 39,114, 21, 67, 65, 12, 47, 73, 46, 27, 25,111,124, 81, 
53, 9,121, 79, 52, 60, 58, 48,101,127, 40,120,104, 70, 71, 43, 
20,122, 72, 61, 23,109, 13,100, 77, 1, 16, 7, 82, 10,105, 98, 



V 
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116, 76, 
51, 17, 
31, 26, 
107, 108, 
ul6 S9[] 



11, 89, 
5, 95, 
45, 75, 

24, 110, 

= { 



106, 0,125,118, 

14, 90, 84, 91, 

4, 85, 92, 37, 

83, 36, 78, 42, 



99, 86, 69, 30, 57,126, 87, 
8, 35,103, 32, 97, 28, 66, 
74, 80, 49, 68, 29,115, 44, 
19, 15, 41, 88,119, 59, 3|; 



,239 


161,379 


391 


334 


9 


338, 38 


226, 48,358,452,385 


90,397, 


,253 


147,331 


415 


340 


51 


362,306 


500,262, 82,216,159 


356,177, 


,241 


489, 37 


206 


17 





333, 44 


254,378, 58,143,220 


81,400, 


3 


315,245 


54 


235 


218 


405,472 


264,172,494,371,290 


399, 76, 


,197 


395,121 


257 


480 


423 


212,240 


28,462,176,406,507 


288,223, 


,407 


249,265 


89 


186 


221 


428,164 


74,440,196,458,421 


350,163, 


,158 


134,354 


13 


250 


491 


142,191 


69,193,425,152,227 


366,135, 


,300 


276,242 


437 


320 


113 


278, 11 


243, 87,317, 36, 93 


496, 27, 


,446 


482, 41 


68 


156 


457 


131,326 


403,339, 20, 39,115 


442,124, 


,384 


508, 53 


112 


170 


479 


151,126 


169, 73,268,279,321 


168,364, 


,292 


46,499 


393 


327 


324 


24,456 


267,157,460,488,426 


309,229, 


,506 


208,271 


349 


401 


434 


236, 16 


209,359, 52, 56,120 


199,277, 


,416 


252,287 


246 


6 


83 


305,420 


345,153,502, 65, 61 


244,282, 


,222 


418, 67 


386 


368 


261 


101,476 


291,195,430, 49, 79 


166,330, 


,383 


373,128 


382 


408 


155 


495,367 


388,274,107,459,417 


62,454, 


,225 


203,316 


234 


14 


301 


91,503 


286,424,211,347,307 


140,374, 


,103 


125,427 


19 


214 


453 


146,498 


314,444,230,256,329 


198,285, 


,116 


78,410 


10 


205 


510 


171,231 


45,139,467, 29, 86 


505, 32, 


, 26 


342,150 


313 


490 


431 


238,411 


325,149,473, 40,119 


174,355, 


,233 


389, 71 


448 


273 


372 


55,110 


178,322, 12,469,392 


369,190, 


,109 


375,137 


181 


88 


75 


308,260 


484, 98,272,370,275 


412,111, 


,318 


4,504 


492 


259 


304 


77,337 


435, 21,357,303,332 


483, 18, 


, 85 


25,497 


474 


289 


100 


269,296 


478,270,106, 31,104 


433, 84, 


,486 


394, 96 


99 


154 


511 


148,413 


361,409,255,162,215 


302,201, 


,351 


343,144 


441 


365 


108 


298,251 


34,182,509,138,210 


335,133, 


,352 


328,141 


396 


346 


123 


319,450 


281,429,228,443,481 


92,404, 


,422 


248,297 


23 


213 


130 


466, 22 


217,283, 70,294,360 


419,127, 


,377 


7,468 


194 


2 


117 


295,463 


258,224,447,247,187 


80,398, 


,353 


105,390 


299 


471 


470 


184, 57 


200,348, 63,204,188 


33,451, 


, 30 


310,219 


94 


160 


129 


493, 64 


179,263,102,189,207 


114,402, 


,477 


387,122 


192 


42 


381 


5,145 


118,180,449,293,323 


136,380, 


, 66 


60,455 


341 


445 


202 


432, 8,, 


237, 15,376,436,464, 


59,461}; 



117 
112 
102 
64, 
static 
167 
183 
175 

95 
165 
501 
232 
344 
487 
475 
363 
439 
465 
173 
280 
132 

35 

50 

72 

185 

1 

336 

47 
414 
266 
311 
485 
312 
284 

97 
438 

43 



/* The sixteen bit input is split into two unequal halves, * 
* nine bits and seven bits - as is the subkey */ 

nine = {ul6) {in>>7) ; 
seven = {ul6) {in&;0x7F) ; 

/* Now run the various operations */ 

nine = {ul6) {S9 [nine] " seven) ; 

seven = {ul6) {S7 [seven] ^ {nine & Ox7F) ) ; 

seven ^= {subl<:ey>>9) ; 
nine ^= (sublcey&OxlFF) ; 

nine = {ul6) (S9 [nine] " seven) ; 

seven = {ul6) {S7 [seven] ^ {nine & Ox7F) ) ; 

in = {ul6) { {seven<<9) + nine) ; 

return { in ) ; 



* F0{) 

* The F0{) function. 

* Transforms a 32-bit value. Uses <index> to identify the 

* appropriate sublceys to use . 

* 

static u32 FO { u32 in, int index ) 

{ 

ul6 left, right ; 

/* Split the input into two 16-bit words */ 

left = {ul6) {in>>16) ; 
right = {ul6) in; 

/* Now apply the same basic transformation three times 
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left ^= KOil [index] ; 

left = FI { left, Kill [index] ) ; 

left *= riglit; 



riglit ^= K0i2 [index] ; 

riglit = FI { rig]it, KI 12 [index] ) ; 

riglit ^= left; 

left ^= K0i3 [index] ; 

left = FI { left, KI 13 [index] ) ; 

left *= riglit; 

in = { { {u32) riglit) <<16) +left; 

return { in ) ; 



* FL{) 

* Tlie FL{) function. 

* Transforms a 32-bit value. Uses <index> to identify t]ie 

* appropriate subJceys to use . 

* 

static u32 FL { u32 in, int index ) 

{ 

ul6 1, r, a, b; 

/* split out the left and right halves */ 



1 = {ul6) {in>>16) ; 
r = {ul6) (in) ; 

/* do the FL { ) operations */ 

a = {ul6) {1 & KLil [index] ) ; 
r ^= R0L16 {a, 1) ; 

b = {ul6) {r I KLi2 [index] ) ; 
1 ^= R0L16 {b, 1) ; 

/* put the two halves baclc together */ 

in = { { {u32) 1) <<16) + r; 

return { in ) ; 



/* 

* Kasumi { ) 

* the Main algorithm {fig 1) . Apply the same pair of operations 

* four times. Transforms the 64-bit input. 

* */ 

void Kasumi { u8 *data ) 

{ 

u32 left, right, temp; 
DWORD *d; 
int n; 

/* Start by getting the data into two 32-bit words {endian corect) */ 

d = {DWORD* ) data; 

left = { { {u32)d[0] .b8 [0] ) <<24) + { { {u32)d[0] .b8 [1] ) <<16) 
+ {d[0] .bS [2]<<8) + {d[0] .b8 [3] ) ; 

right = { { {u32) d [1] .b8 [0] ) <<24) + { { {u32) d [1] .b8 [1] ) <<16) 
+ {d[l] .b8 [2] <<8) + {d[l] .b8 [3] ) ; 
n = 0; 
do{ temp = FL { left, n ) ; 

temp = FO { temp, n++ ) ; 

right ^= temp; 

temp = FO { right, n ) ; 

temp = FL { temp, n++ ) ; 

left ^= temp; 
}while { n<=7 ) ; 

/* return the correct endian result */ 

d[0].b8[0] = {u8) {left>>24) ; d[l].b8[0] = {u8) {right>>24) ; 

d[0].b8[l] = {u8) {left>>16) ; d[l].b8[l] = {u8) {right>>16) ; 
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d[0].b8[2] = {u8) (left>>8) ; d[l].b8[2] = {u8 ) {right>>8 ) ; 

d[0].b8[3] = {u8)(left); d[l].b8[3] = {u8) (right) ; 

} 

/* 

* KeySchedule { ) 

* Build the key schedule. Most "key" operations use 16-bit 

* subkeys so we build ul6-sized arrays that are "endian" correct. 

* */ 

void KeySchedule { u8 *k ) 

{ 

static ul6 C[] = { 

0x012 3, 0x4 5 6 7, 0x8 9AB, OxCDEF, OxFEDC, 0xBA98 , 0x7654 , 0x3210 } ; 
ul6 key[8], Kprime[8]; 
WORD *kl6; 
int n; 

/* Start by ensuring the subkeys are endian correct on a 16-bit basis */ 

kl6 = {WORD *)k; 

f or { n=0,- n<8; ++n ) 

key[n] = {ul6) { {kl6 [n] .b8 [0] <<8) + {kl6 [n] .b8 [1] ) ) ; 

/* Now build the K' [] keys */ 

f or { n=0; n<8; ++n ) 

Kprime [n] = {ul6){key[n] ^ C [n] ) ; 

/* Finally construct the various sub keys */ 

f or { n=0; n<8; ++n ) 

{ 

KLil [n] = R0L16 {key [n] , 1) ; 

KLi2 [n] = Kprime [ {n+2) &0x7] ; 

KOil [n] = R0L16 {key [ {n+D &0x7] , 5) ; 

K0i2 [n] = R0L16 {key [ {n+5) &0x7] , 8) ; 

K0i3 [n] = R0L16 {key [ {n+6) &0x7] , 13) ; 

KIil[n] = Kprime [ {n+4) &0x7] 

KIi2 [n] = Kprime [ {n+3) &0x7] 

KIi3 [n] = Kprime [ {n+7) &0x7] 



end of kasumi 
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